Vulnerability in Sdmc Technology Co., Ltd Ne6037
CVE-2026-24444
SDMC NE6037 cable modem routers running firmware 7.1.6.0.25 and 7.1.6.1.9_B9 contain a hardcoded password vulnerability in the web management interface recovery endpoints (mgmt.php, npcmd.php) that allows unauthenticated attackers to gain root access by submitting the hardcoded credential to the recovery endpoint via HTTP. Attackers can leverage this hardcoded password to enable filtered SSH and Telnet services on the device, resulting in unauthenticated root-level remote access to the underlying system.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.005 (43.0th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 43rd percentile — 43.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: 0.000
Affected products
- Sdmc Technology Co., Ltd Ne6037 — versions 7.1.6.0.25, 7.1.6.1.9_B9
Weakness classification (CWE)
References
- www.kr3bz.wtf/posts/sdmc-ne6037-router-recovery-backdoor/ (technical-description, exploit)
- en.sdmctech.com/product/DOCSIS_234.html (product)
Frequently asked questions
- What is CVE-2026-24444?
- CVE-2026-24444 is a critical-severity vulnerability in Sdmc Technology Co., Ltd Ne6037, classified under Use of Hard-coded Credentials. CVSS score: 9.8/10. Published 2026-05-28.
- How severe is CVE-2026-24444?
- Critical severity. CVSS v3 base score is 9.8 out of 10.